Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
13/11/2024, 14:07
Static task
static1
Behavioral task
behavioral1
Sample
08111cbfee05bb99a99073e760bf09e53a9cdb627189de0030b89f7853174529.dll
Resource
win7-20241010-en
General
-
Target
08111cbfee05bb99a99073e760bf09e53a9cdb627189de0030b89f7853174529.dll
-
Size
596KB
-
MD5
f12af11ac600e396c476f87fb488a989
-
SHA1
764495ca03102698480ad18a6a5bead430be46ca
-
SHA256
08111cbfee05bb99a99073e760bf09e53a9cdb627189de0030b89f7853174529
-
SHA512
5c762bec9198258ef014dc6d2687dfdb1c8a0b36ebf8986bb12056d23453cca8a0453b313f4f61a595364c8d3644115c1e7942d54666482232672ad86c18db27
-
SSDEEP
6144:8B4oWMvCBs0YaUG7qJFzR4Dpw0yHz4MmjOfg54hOSRhnID3FQizX5+IgtidXX5+o:8uLMviuaUsqTd45yHz4Mmj/STe5
Malware Config
Extracted
emotet
Epoch5
185.244.166.137:443
185.168.130.138:443
59.148.253.194:443
78.46.73.125:443
195.77.239.39:8080
104.131.62.48:8080
69.16.218.101:8080
203.153.216.46:443
195.154.146.35:443
190.90.233.66:443
191.252.103.16:80
37.44.244.177:8080
168.197.250.14:80
116.124.128.206:8080
54.37.228.122:443
159.69.237.188:443
85.214.67.203:8080
210.57.209.142:8080
78.47.204.80:443
185.148.168.220:8080
142.4.219.173:8080
85.25.120.45:8080
128.199.192.135:8080
66.42.57.149:443
62.171.178.147:8080
54.38.242.185:443
217.182.143.207:443
185.148.168.15:8080
37.59.209.141:8080
207.148.81.119:8080
Signatures
-
Emotet family
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2032 wrote to memory of 2636 2032 regsvr32.exe 30 PID 2032 wrote to memory of 2636 2032 regsvr32.exe 30 PID 2032 wrote to memory of 2636 2032 regsvr32.exe 30 PID 2032 wrote to memory of 2636 2032 regsvr32.exe 30 PID 2032 wrote to memory of 2636 2032 regsvr32.exe 30 PID 2032 wrote to memory of 2636 2032 regsvr32.exe 30 PID 2032 wrote to memory of 2636 2032 regsvr32.exe 30 PID 2636 wrote to memory of 2228 2636 regsvr32.exe 31 PID 2636 wrote to memory of 2228 2636 regsvr32.exe 31 PID 2636 wrote to memory of 2228 2636 regsvr32.exe 31 PID 2636 wrote to memory of 2228 2636 regsvr32.exe 31 PID 2636 wrote to memory of 2228 2636 regsvr32.exe 31 PID 2636 wrote to memory of 2228 2636 regsvr32.exe 31 PID 2636 wrote to memory of 2228 2636 regsvr32.exe 31
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\08111cbfee05bb99a99073e760bf09e53a9cdb627189de0030b89f7853174529.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\08111cbfee05bb99a99073e760bf09e53a9cdb627189de0030b89f7853174529.dll2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\08111cbfee05bb99a99073e760bf09e53a9cdb627189de0030b89f7853174529.dll",DllRegisterServer3⤵
- System Location Discovery: System Language Discovery
PID:2228
-
-